CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

EUVD-2026-91160

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2026-104054

A security flaw in calcom cal.diy up to version 6.2.0 allows for missing authorization due to a vulnerability in the PBAC Permission Engine component. Specifically, the doesUserIdHaveAccessToBooking function within the BookingAccessService.ts file can be manipulated to bypass intended access cont...

CVE-2026-47603

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-105046: Direct Request

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

JetBrains YouTrack < 2026.2.18991 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18991. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification template...

PT-2026-104443

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An authorization flaw exists in the UTMIncidentCommandWebsocket.processCommand function, which handles the '/command/hostname' STOMP destination. The system fails to perform role checks or apply a...

Grafana Labs 11.6.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Missing Authorization (CVE-2026-81841)

The version of Grafana Labs installed on the remote host is 11.6.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by a missing authorization vulnerability: - Pausing a shared public dashboard did not...

CVE-2026-82041: Missing Authorization

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand, the handler mapped to the /command/hostname STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user,...

PT-2026-104069

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus ≤ 2.0.8 — 缺少授权导致已认证（订阅者+）站点重置和权限提升 CVE-2025-14364 — Demo Importer Plus · 全站重置 → 权限提升 / \ / | / \ | /| || | || \ / | / / / | | | | 已认证的订阅者 → 管理员，通过do-reinstall AJAX 动作 〔 1 〕 漏洞 | ---|--- CVE| CVE-2025-14364 CVSS v3.1| 8.8 高 —...

CVE-2026-4106

CVE-2026-4106: Exploit de Divulgación de PII No Autenticada en WordPress HT Mega Un exploit de Prueba de Concepto PoC robusto y multiproceso para CVE-2026-4106 , dirigido al plugin HT Mega - Absolute Addons for Elementor para WordPress versiones 3.0.7. Resumen de la Vulnerabilidad El plugin HT Me...

terrapod-PoC

Terrapod: aviso de seguridad Estado del CVE: solicitado, pendiente de asignación. Este hallazgo se publica como GHSA-6qrc-597p-mrp9. Tras la asignación del CVE, este repositorio se renombra CVE-YYYY-NNNNN-terrapod-PoC y este banner se reemplaza con el enlace del CVE. | ---|--- Investigador|...

CVE-2026-1937

🔴 Resumen de la Vulnerabilidad CVE-2026-1937 — Autorización faltante → Actualización arbitraria de opciones → Escalada de privilegios Campo| Detalles ---|--- ID CVE| CVE-2026-1937 Gravedad| ALTA — Puntuación CVSS v3.1: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence...

CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary

👤 Autor Mohammed Idrees Banyamer Investigador de Seguridad 📌 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2026-25939 , una vulnerabilidad crítica de omisión de autorización en FUXA software SCADA/ICS de código abierto. La vulnerabilidad permite a atacantes remot...

CVE-2026-0628-POC

CVE-2026-0628-POC Prueba de concepto PoC para CVE-2026-0628, que demuestra la inyección de scripts en páginas privilegiadas mediante el uso de la etiqueta en Google Chrome. Esta vulnerabilidad, clasificada como CWE-862 Missing Authorization, permite a una extensión maliciosa eludir políticas de...

CVE-2026-26418

CVE-2026-26418 Autenticación y Autorización Faltantes en la API Web Resumen de la Vulnerabilidad Se identificó una vulnerabilidad de autenticación y autorización faltantes en la capa de API Web de Tata Consultancy Services TCS – Cognix Recon Client v3.0. Ciertos endpoints de API expuestos no...

CVE-2026-26417

CVE-2026-26417 Control de Acceso Roto en la Funcionalidad de Restablecimiento de Contraseña Resumen de la Vulnerabilidad Se identificó una vulnerabilidad de control de acceso roto en Tata Consultancy Services TCS – Cognix Recon Client v3.0. El problema permitía a usuarios autenticados restablecer...

CVE-2026-70481

CVE-2026-70481 Open WebUI, afectado desde 0.5.0 hasta 0.10.2, parcheado en 0.11.0. Moderado, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 y CWE-862. En backend/openwebui/routers/channels.py los manejadores de actualización y eliminación de mensajes se ramifican según el tipo de...